Executive brief
Multer is a widely-used Node.js middleware for handling file uploads in web applications. When configured with asynchronous file filtering, the file size limit can be bypassed, allowing oversized files to be uploaded and accepted. An attacker could exploit this to bypass upload restrictions, potentially leading to disk exhaustion, denial of service, or uploading malicious files that should have been rejected.
Technical details
The vulnerability is a race condition (CWE-362) in multer's file upload handling when an asynchronous fileFilter is configured. The root cause is that the 'limit' event listener, which enforces the limits.fileSize restriction, is registered inside the async fileFilter callback. If a file exceeds limits.fileSize before the callback executes, the size-check event is never registered, causing the oversized file to be accepted instead of triggering a LIMIT_FILE_SIZE error. This affects all upload methods (.single(), .array(), .fields(), .any()). Applications using synchronous fileFilter functions are not affected. The vulnerability requires an attacker to upload files via the web interface but no authentication or special privileges. A patch is available in version 2.3.0; workarounds include switching to synchronous fileFilter or validating file size after upload completes.
Affected products
- expressjs multer < 2.3.0
Timeline
- 2026-08-28: disclosed: Vulnerability published by NVD
- 2026-09-08: advisory: GitHub Advisory Database review and publication
- 2026-09-08: patched: Version 2.3.0 released with fix